Subject: Re: Guestgroup /bin/ls on IRIX5.3

From: Mark Bergstrom <[email-masked]>
Date: Mon, 31 Mar 1997 20:42:14 -0600 (CST)

Maybe a title change will get somebody's attention.

I've been through ftpd.c over and over.  I can't see why only one command
'/bin/ls' is broken for the guestgroup.  The chroot and chdir obviously
work.  And as I have noted in my prior posts, '/bin/ls' is NOT broken for
anonymous or for real users.
____
The parallel discussion thread of various shells under IRIX6.2 seems to be
irrelevant here.  I am not seeing any 'type of shell' problems at all no
matter what I use for the guestgroup access.
____

With the debug option on and connecting via ftp client, the messages for the
'ls' command that appear indicate a perfectly normal operation.

But nothing shows up.  All messages show connection open, the message 150
ascii transfer, connection closing.  And nothing shows up.

------------

Trying via telnet rather than ftp client, I connect to the port, login, give
the password and CWD STOR RETR CDUP and so on all work Except LIST  which
gives the 425 message from the source:

        425 Can't build data connection: Connection refused.

on trying to list the current directory (or any suitable path).

The only ls-specific difference between anonymous and guestgroup(or real) I
can see is in ftpcmd.y but since the command works for real users I do not
understand why the chrooted version inside the bin directory of the 'sample'
guestuser would clutch up.

MB

---

From: Michael Brennen <[email-masked]>
Date: Mon, 31 Mar 1997 21:05:44 -0600 (CST)

> anonymous or for real users.

Assuming you have installed a ~/bin/ls in the chrooted guest account, ls
in the guest environment is usually broken because it does not have access
to the necessary shared libraries or devices.  It is because the chroot
works that the shared libraries in /lib, /usr/lib or wherever are no
longer accessible. If you've not read it yet, this is explained in the
guest howto (below).  One solution is a static linked ls if it is an
option for you; you may still need ~/dev files, depending on the platform. 

The specifics for this are different for each OS; I've collected a few OS
specifics at the end of the guest howto.  Some IRIX configuration data was
added recently. 

> matter what I use for the guestgroup access.

True; the shells discussion is irrelevant for non operational ls. 

> ascii transfer, connection closing.  And nothing shows up.

Because ls is not running to completion; it can't, as it does not have the
libraries or devices it needs.

If in the process of setting up your site you find additional OS specific
information about the IRIX setup, please email it to me so I can add it to
the guest howto.  Thanks,

   -- Michael

This is the location for the latest wu-ftpd.  You can't see the
directory contents, but get the file anyway.  It's there.

ftp://ftp.academ.com/pub/wu-ftpd/private/wu-ftpd-2.4.2-beta-13.tar.Z

wu-ftpd FAQ:  http://www.cetis.hvu.nl/~koos/wu-ftpd-faq.html
              OR
              send mail to [email-masked]
              with a subject line: send faq

guest howto:  ftp://ftp.fni.com/pub/wu-ftpd/guest-howto
              OR
              send mail to "[email-masked]"
              (immediate autoresponder; subject does not matter)

wu-ftpd list archive:  http://www.landfield.com/wu-ftpd/mail-archive/

There are additional security references in the above docs.

---

From: [email-masked] (Jim Robinson)
Date: Mon, 31 Mar 1997 22:49:20 -0500

I am having the exact problem where the ls command shows nothing when used
by a guest user. I have solved the problem, sort of. Firstly my /etc/passwd
entry for a guest user looks like this guest:xxxxxxxx:guest ftp
user:~ftp/user/guest:/bin/csh. In this config it seems to work however it
leaves a huge security hole as the guest ftp user can telnet into the host
machine. If I enter the /etc/passwd as follows the guest user is chrooted
into the directory guest but the problem of no list coming up occurs.
guest:xxxxxxxx:guest ftp user:~ftp/user/./guest:/bin/csh. I noted that you
were using irix version 5.3 and I know that with 6.2 if you check the man
page for ftpd there is some good info on how to make the "ls" work for
anonymous users which seemed to solve a lot of my problems except with the
dreaded "guest user". I know this is probably more confusing than help but
I tried. Cheers.....JR
Jim A Robinson
[email-masked]
www.fitertown.com
www.moneypitltd.com

---

From: Michael Brennen <[email-masked]>
Date: Mon, 31 Mar 1997 22:40:13 -0600 (CST)

guest:*:guest ftp user:~ftp/user/./guest:/etc/ftponly

Use a single x or * as the password and you can lock the account from
login.  This may vary system to system; check yours specifically.  I think
the shadow password system wants a single x.  Also, use a non existent or
non executable shell, such as the dummy entry /etc/ftponly, and you should
be okay. 

   -- Michael

On Mon, 31 Mar 1997, Jim Robinson wrote:

> I tried.